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IN THE CLAIMS 

Please amend the claims as follows: 

1-2. (canceled) 

3. (previously presented) The method of claim 30, wherein the vulnerability includes a 
vulnerability to a computer virus. 

4. (previously presented) The method of claim 30, wherein the vulnerability includes a 
vulnerability to computer hacking. 

5. (previously presented) The method of claim 30 further comprising: 
classifying the data processing systems storing replicas of the resource as vulnerable, 

wherein the classifying is responsive to the predetermined number of changed replicas of the 
resource being exceeded and the predetermined time duration being exceeded. 

6. (previously presented) The method of claim 30 further comprising: 

replacing the replica of the resource at each of the data processing systems storing a 
replica of the resource, wherein the replacing is responsive to the predetermined number of 
changed replicas of the resource being exceeded and the predetermined time duration being 
exceeded. 

7. (previously presented) The method of claim 30 further comprising: 

patching the replica of the resource at each of the data processing systems storing a 
replica of the resource, wherein the patching is responsive to the predetermined number of 
changed replicas of the resource being exceeded and the predetermined time duration being 
exceeded. 

8. (previously presented) The method of claim 7, further comprising: 
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prior to patching the replica of the resource, comparing a set of hash values representing 
all pre-requisite programs of patch code with a stored set of hash values; and 

in response to identification of matching hash codes for all pre-requisite programs, 
determining that said patching of the replica of the resource should proceed. 

9. (previously presented) The method of claim 30 the steps further comprising: 
sending a notification of the vulnerability to each data processing system storing a replica 

of the resource, wherein the sending is responsive to the predetermined number of changed 
replicas of the resource being exceeded and the predetermined time duration being exceeded. 

10. (previously presented) The method of claim 9, further comprising: 

selecting a sequence of vulnerability-resolution instructions relevant to the vulnerability 
and including the selected instructions within the notification sent to each data processing 
system. 

1 1 - 29. (canceled) 

30. (currently amended) A method within a network having a vulnerability, the method 
comprising the steps of: 

computing first hash values derived from and representing a plurality of replicas of a 
resource, wherein the replicas of the resource are stored on respective data processing systems 
within a network; 

storing the computed set of first hash values, wherein the storing includes: 

3toring identifications of the respective ones of said data processing systems 

3toring the rcplica3 of the resource; and 

3toring time stamps for the hash values; 

wherein the method further comprises: 

computing at least second hash values for the replicas of the resource, wherein the 
computing of the at least second hash values is at a time after the computing of the first hash 
values; 
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computing current hash vafaes for the replicas of the resource, wherein the computing of 
the current hash values i3 at a time after the computing of the at lca3t second hash values; 

comparing the hash values computed at successive times for each respective replica of the 
resource, in order to identify whether matching hash valuc3 exist; 

comparing time 3tamp3 for matching hatch values of each respective replica of the 
resource \ 

computing, responsive to comparing t he time stamp s and the hash values computed at 
successive times - comparison , a time duration during which the hash values of each respective t he 
replicas of the resource remained unchanged; and 

detecting for a current time, responsive to the hash value comparison indicating thatat 
least one of the replicas of the resource have changed from one time to the current time, whether 
the changed replicas of the resource at the current time indicate a vulnerability, wherein the 
detecting comprises: 

detecting whether the computed time duration prior to the current time exceeds a 
predetermined time duration; and 

detecting whether changed replicas of the resource at the current time arc more 
numerous than a predetermined number; and 
wherein the method further comprises: 

presenting a message for a user indicating the changed replicas of the resource arc due to 
a vulnerability, wherein the presenting is responsive to the predetermined number of changed 
replicas of the resource being exceeded and the predetermined time duration being exceeded. 

31. (previously presented) An apparatus comprising: 
a processor; and 

a storage device connected to the processor, wherein the storage device has stored thereon 
a program, wherein the processor is operative to execute instructions of the program to 
implement a method comprising the steps of: 

computing first hash values derived from and representing a plurality of replicas of a 
resource, wherein the replicas of the resource are stored on respective data processing systems 
within a network; 
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storing the computed set of first hash values ;, wherein the storing includes: 

storing identifications of the respective o n e s o f said data processing systems 
storing the replicas of the resource; and 

storing time stamps for the hash values; 

wherein the method further comprises: 

computing at least second hash values for the replicas of the resource, wherein the 
computing of the at least second hash values is at a time after the computing of the first hash 
values; 

computing current hash values for the replicas of the resource, wherein the computing of 
the curr ent hash values i3 at a time after the computing of the at least second hash values; 

comparing the hash values computed at a inc i si ve times for each respective replica of the 
resource, in order to identify whether matching hash values exist; 

comparing time 3tamps for matching hatch values of each respective replica of the 
resource; 

computing, responsive to comparing t he time stam ps and the hash values computed at 
successive time s comparison , a time duration during which the hash values of each respective 
replica of the resource remained unchanged; 

detecting for a current time, responsive to the hash value comparison indicating that_at 
least one of the replicas of the resource has h ave changed from one time to the current time, 
whether the at least one c hanged replicas of the resource at the current time indicates a 
vulnerability, wherein the detecting comprises: 

detecting whether the computed time duration prior to the current time exceeds a 

predetermined time duration;-a«d 

detecting whether changed replica s of the resource at the current time arc more 

numerous than a predetermined number; and 

wherein the method further comprises: 
I presenting a message for a user indicating the changed replicas of the resource arc due to 

j a vulnerability, wherein the presenting is responsive to the predetermined number of changed 
j replicas of the resource being exceede d and the predetermined time duration being exceeded. 
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32. (previously presented) The apparatus of claim 31, wherein the vulnerability includes a 
vulnerability to a computer virus. 

33. (previously presented) The apparatus of claim 31, wherein the vulnerability includes a 
vulnerability to computer hacking. 

34. (previously presented) The apparatus of claim 31, the steps further comprising: 
classifying the data processing systems storing replicas of the resource as vulnerable, 

wherein the classifying is responsive to the predetermined number of changed replicas of the 
resource being exceeded and the predetermined time duration being exceeded. 

35. (previously presented) The apparatus of claim 31, the steps further comprising: 
replacing the replica of the resource at each of the data processing systems storing a 

replica of the resource, wherein the replacing is responsi ve to the predetermined number of 
changed replicas of the resource being exceeded and the predetermined time duration being 
exceeded. 

36. (previously presented) The apparatus of claim 31, the steps further comprising: 
patching the replica of the resource at each of the data processing systems storing a 

replica of the resource, wherein the patching is responsive to the predetermined number of 
changed replicas of the resource being exceeded and the predetermined time duration being 
exceeded. 

37. (previously presented) The apparatus of claim 36, the steps further comprising: 
prior to patching the replica of the resource, comparing a set of hash values representing 

all pre-requisite programs of patch code with a stored se t of hash values; and 

in response to identification of matching hash codes for all pre-requisite programs, 
determining that said patching of the replica of the resource should proceed. 

38. (previously presented) The apparatus of claim 31, the steps further comprising: 
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sending a notification of the vulnerability to each data processing system storing a replica 
of the resource, wherein the sending is responsive to the predetermined number of changed 
replicas of the resource being exceeded and the predeteimined time duration being exceeded. 

39. (previously presented) The apparatus of claim 38, the steps further comprising: 
selecting a sequence of vulnerability-resolution i nstructions relevant to the vulnerability 

and including the selected instructions within the notification sent to each data processing 
system. 

40. (currently amended) A computer program product, stored on a tangible, computer 
readable medium, said computer program product having instructions for execution by a 
computer system, wherein the instructions, when executed by the computer system, cause the 
computer system to implement a method comprising the: steps of: 

computing first hash values derived from and representing a plurality of replicas of a 
resource, wherein the replicas of the resource are stored on respective data processing systems 
within a network; 

storing the computed set of first hash values and time stamps for the first hash values- 
wherein the storing includes: 

storing identifications of the respective ones of said data processing systems 
storing the replicas of the resource; and 

storing time stamps for the hash values; 

wherein the method further comprises: 

computing at least second hash values for the replicas of the resource, wherein the 
computing of the at least second hash values is at a time after the computing of the first hash 
values; 

computing current hash values for the replicas of the resource, wherein the computing of 
the current hash values is at a time after the computing of the at least second hash values; 

comparing the hash values computed at successive times for each respective replica of the 
resource, in order to identify whether matching hash values exist; 
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comparing time 3tamp3 for matching hatch vafa s s o f each respective replica of the 
resource ; 

computing, responsive to comparing t he time stamp s and the hash values computed at 
successive times comparison , a time duration during which the hash values of each respective t he 
replicas of the resource remained unchanged; and 

detecting for a current time, responsive to the hash value comparison indicating that_at 
least one of the replicas of the resource has have changed from one time to the current time, 
whether the at least one c hanged replicas of the resource at the current time indicates a 
vulnerability, wherein the detecting comprises: 

detecting whether the computed time duration prior to the current time exceeds a 

predetermined time duration; and 

detecting whether changed replicas of the resource at the current time arc more 

numerous than a predetermined number; and 



wherein the method further comprises: 

presenting a message for a user indicating the changed rcplica3 of the resource arc due to 
a vulnerability, wherein the presenting is responsive to the predetermined number of changed 
replicas of the resource being exceeded and the predetermined t ime duration being exceeded. 

41. (previously presented) The computer program product of claim 40, wherein the 
vulnerability includes a vulnerability to a computer virus. 



42. (previously presented) The computer program product of claim 40, wherein the 
vulnerability includes a vulnerability to computer hacking. 



43. (previously presented) The computer program product of claim 40, the steps further 
comprising: 

classifying the data processing systems storing replicas of the resource as vulnerable, 
wherein the classifying is responsive to the predetermined number of changed replicas of the 
resource being exceeded and the predetermined time duration being exceeded. 
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44. (previously presented) The computer program product of claim 40, the s teps further 
comprising: 

replacing the replica of the resotirce at each of the data processing systems storing a 
replica of the resource, wherein the replacing is responsive to the predetermined number of 
changed replicas of the resource being exceeded and the: predetermined time duration being 
exceeded. 

45. (previously presented) The computer program product of claim 40, the steps further 
comprising: 

patching the replica of the resource at each of the data processing systems storing a 
replica of the resource, wherein the patching is responsive to the predetermined number of 
changed replicas of the resource being exceeded and the predetermined time duration being 
exceeded. 

46. (previously presented) The computer program product of claim 45, the steps further 
comprising: 

prior to patching the replica of the resource, comparing a set of hash values representing 
all pre-requisite programs of patch code with a stored set of hash values; and 

in response to identification of matching hash codes for all pre-requisite programs, 
determining that said patching of the replica of the resource should proceed. 

47. (previously presented) The computer program product of claim 40, the steps further 
comprising: 

sending a notification of the vulnerability to each data processing system storing a replica 
of the resource, wherein the sending is responsive to the predetermined number of changed 
replicas of the resource being exceeded and the predetermined time duration being exceeded. 
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48. (previously presented) The computer program product of claim 47, the steps further 
comprising: 

selecting a sequence of vulnerability-resolution instructions relevant to the vulnerability 
and including the selected instructions within the notification sent to each data processing 
system. 
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